Security And Identity — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Identity Provider (IdP) / SSO & Directory
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAuth0 Free: 7,500 MAU, 2 social IdPs, unlimited logins. Essentials $35/mo incl 1k MAU + $0.15/MAU overage, B2B SSO $0.25/MAU. Azure AD Free: 50k dir objects free, P1 $6/user/mo, P2 $9/user/mo incl Identity Protection + PIM. Okta: SSO $2/user/mo min 100 users, Adaptive MFA $4/user/mo, Lifecycle $4/user/mo. Overage $2.50/user/mo. WorkOS: Free 1M MAU dev, prod $99/mo per SSO bundle + $0.10/MAU after. Keycloak VM cost $5-20/mo.
Multi-Factor Authentication (MFA) Enforcement
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAuth0 MFA: TOTP/WebAuthn free, 1k SMS free/yr then $0.05/SMS. Duo Free: 10 users free, Essentials $3/user/mo, Advantage $6/user/mo (risk-based). Okta MFA $4/user/mo incl push + risk engine. Azure MFA free with P1 ($6) / P2 ($9). SMS overage $0.05-0.08/msg, Voice $0.10/verify. Push free unlimited.
Secrets Management (Vault / Parameter Store)
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsVault OSS: free + VM $10-50/mo. HCP Vault Standard $0.03/hr ~$22/mo + $0.08/secret/mo, Plus $0.10/hr. AWS Secrets: $0.40/secret/mo, $0.05 per 10k API calls, free rotation Lambda (1M invocs free). SSM Standard free 10k, Advanced $0.05/param/mo. Doppler: Free 5 users, Pro $10/user/mo 500 secrets $0.30/secret over. Infisical Free 2 projects, Pro $20/mo 10k secrets.
Key Management Service (KMS) - Encryption Key Lifecycle
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS KMS: $1/mo per customer key, $0.03 per 10k symmetric requests, $0.15 per 10k asymmetric/RSA, free 20k requests for AWS-managed keys. GCP KMS: $1/key version/mo, $0.03/10k ops, $0.12/10k HSM ops. Azure Key Vault: $1/key/mo Standard $0.03/10k ops, Premium $5/key/mo $0.15/10k ops. Overage: $0.03/10k ops. Auto-rotation free.
Hardware Security Module (HSM) / Dedicated Key Protection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS CloudHSM: $1.88/hr per HSM ~$1,373/mo, HA 2-HSM cluster ~$2,746/mo + $0.50/hr backup + $0.20/GB snapshot. Min 1. No free tier. GCP Cloud HSM: $5/key version/mo HSM-protected + $1/hr HSM provisioning $0.15/10k ops. Azure Managed HSM: $1.45/hr $1,055/mo per HSM pool min 3 HSMs ~$3,165/mo. Thales Luna Cloud: $2.5/hr $1,825/mo + $0.50/GB backup. YubiHSM 2 hardware $650 one-time.
Encryption at Rest (S3/EBS/SSE-KMS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsS3 SSE-S3 free, 0% overhead. SSE-KMS: $1/key/mo + $0.03/10k KMS requests, adds ~$0.01 per 1k PUT GET overhead. S3 Bucket Keys $1/mo per bucket key reduces calls 99%. EBS encryption free switch, snapshot copy free + KMS cost if customer key $1/mo. GCS default free. No free tier limit as feature free; overage only KMS API $0.03/10k.
Encryption in Transit / TLS Certificate Management
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsACM Public: free unlimited, auto-renew 13mo. Let's Encrypt free 90d, 50 certs/week/domain, 300 pending auth. Cloudflare Free 15-yr origin cert free. ACM Private CA $400/mo per CA + $0.75 per cert first 1k then $0.35, $0.001 per OCSP. Smallstep $10/mo 100 certs $0.10/cert over. DigiCert OV $250/yr ~$21/mo, EV $600/yr. Private cert overage $0.75 each.
Web Application Firewall (WAF) / Edge Protection
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCloudflare Free: 1 rule free. Pro $20/mo 20 rules + $5/10k managed req after 10M, $0.50/1k R2? Business $200/mo 100 rules free 10M req. Enterprise $5k/mo custom unlimited + $0.50/M over 100M. AWS WAF: $6/mo WebACL + $1/mo per rule, $1 per 1M requests, Bot Control $10/mo $1 per 1k bot req after 1M, Fraud $10/mo $1/10k fraud eval. Overages $1/1M req.
Threat Detection (GuardDuty / Cloud-native)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsGuardDuty: 30d free, then CloudTrail Mgmt $1.20/1M events (100M-500M $1.00, 500M+ $0.90), VPC Flow $0.30/GB first TB then $0.15, DNS $3.50/GB, S3 $0.20/GB, EKS Audit $1.20/1M. Security Hub CSPM $0.0010/check first 100k $0.0008 after 100k. Defender: Servers $15/server/mo. GCP SCC Premium $10-15/vCPU/mo. Overage $0.30/GB flow, $1.20/M events.
Vulnerability / CSPM / CNAPP (Wiz, Prisma, Orca)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWiz: Free 30d POC, then $2,500/mo base for 100 VMs/containers + $0.10/serverless hr overage + $5 per storage bucket extra. Prisma Cloud: $50k/yr base 500 resources ~$4,167/mo + $0.15/resource/mo overage + Compute $10/host/mo over. Orca $2,083/mo 250 assets $8/asset over. Prowler self-host $10/mo VM free scanning unlimited. Commercial overage $5-10/resource/mo.
SIEM / Security Log Lake & Data Lake
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPanther Free 500GB/mo ingest + 90d retention, then $0.10/GB up to 10TB $0.08/GB over 10TB + $500/mo platform base after 1TB. Splunk Cloud $150/GB/mo ingest min $750/mo, Enterprise $6k/yr per 1GB/day $0.50k. Sentinel PayGo $2.46/GB ingest, $0.12/GB archive, reservations $1.23/GB commitment 100GB/day $0.10/GB over. Security Lake storage $0.023/GB Standard $0.0125 S3 IA. OpenSearch self-host $50-200/mo VM.
How this hobby security and identity checklist works.
Each requirement below is something a hobby security and identity build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.